Technology

Google dismantles 9M-device Android hijack network

Published

5 days ago

February 28, 2026

Google dismantles 9M-device Android hijack network

NEWYou can now listen to Fox News articles!

Free apps are supposed to cost you nothing but storage space. But in this case, they may have cost millions of people control over their own internet connections.

Google says it has disrupted what it believes was the world’s largest residential proxy network, one that secretly hijacked around 9 million Android devices, along with computers and smart home gadgets. Most people had no idea their devices were being used since the apps worked normally, and nothing looked broken.

But behind the scenes, those devices were quietly routing traffic for strangers, including cybercriminals.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

STOP GOOGLE FROM FOLLOWING YOUR EVERY MOVE

Google says it disrupted a massive residential proxy network that secretly hijacked about 9 million Android and smart devices. (AaronP/Bauer-Griffin/GC Images)

How your device became part of a proxy network

According to Google’s Threat Intelligence Group, the network was tied to a company known as IPIDEA. Instead of spreading through obvious malware, it relied on hidden software development kits, or SDKs, that were embedded inside more than 600 apps. These apps ranged from simple utilities to VPN tools and other free downloads. When you installed one, the app performed its advertised function. But it also enrolled your device into a residential proxy network.

That means your phone, computer or smart device could be used as a relay point for someone else’s internet traffic. That traffic might include scraping websites, launching automated login attempts or masking the identity of someone conducting shady online activity. From the outside, it looked like that activity came from your home IP address. You wouldn’t see it happening, and in many cases, you wouldn’t notice any major performance issues.

Google says in a single seven-day period earlier this year, more than 550 separate threat groups were observed using IP addresses linked to this infrastructure. That includes cybercrime operations and state-linked actors. Residential proxy networks are attractive because they make malicious traffic look like normal consumer activity. Instead of coming from a suspicious data center, it appears to come from someone’s living room.

What Google did to shut it down

Google says it took legal action in a U.S. federal court to seize domains used to control the infected devices and route proxy traffic. It also worked with companies like Cloudflare and other security firms to disrupt the network’s command-and-control systems. Google claims it also updated Play Protect, the built-in Android security system, so that certified devices would automatically detect and remove apps known to include the malicious SDKs.

However, Google also warned that many of these apps were distributed outside the official Play Store. That matters because Play Protect can only scan and block threats tied to apps installed through Google Play. Third-party app stores, unofficial downloads and uncertified Android devices carry far greater risk.

IPIDEA has claimed its service was meant for legitimate business use, such as web research and data collection. But Google’s research suggests the network was heavily abused by criminals. Even if some users knowingly installed bandwidth-sharing apps in exchange for rewards, many did not receive clear disclosure about how their devices were being used.

Google’s investigation also found significant overlap between different proxy brands and SDK names. What looked like separate services were often tied to the same infrastructure. That makes it harder for consumers to know which apps are safe and which are quietly monetizing their connection.

300,000 CHROME USERS HIT BY FAKE AI EXTENSIONS

Hidden software inside more than 600 apps allegedly turned phones and computers into internet relays for cybercriminals. (David Paul Morris/Bloomberg via Getty Images)

7 ways you can protect yourself from Android proxy attacks

If millions of devices can be quietly turned into internet relay points, the big question is, how do you make sure yours isn’t one of them? These steps reduce the risk that your phone, TV box or smart device gets pulled into a proxy network without you realizing it.

1) Stick to official app stores

Only download apps from the Google Play Store or other trusted app marketplaces. Some apps hide small pieces of code that can secretly use your internet connection. These are often spread through third-party app stores or direct app files called “APKs,” which are Android app files installed manually instead of through the Play Store. When you sideload apps this way, you bypass Google’s built-in security checks. Sticking to official stores helps keep those hidden threats off your device.

2) Avoid “earn money by sharing bandwidth” apps

If an app promises rewards for sharing your unused internet bandwidth, that’s a major red flag. In many cases, that is exactly how residential proxy networks recruit devices. Even if it sounds legitimate, you are effectively renting out your IP address. That can expose you to abuse, blacklisting or deeper network vulnerabilities.

3) Review app permissions carefully

Before installing any app, check what permissions it requests. A simple wallpaper app should not need full network control or background execution privileges. After installation, go into your phone’s settings and audit which apps have constant internet access, background activity rights or special device permissions.

4) Install strong antivirus software

Today’s mobile security tools can detect suspicious app behavior, unusual internet activity and hidden background services. Strong antivirus software adds an extra layer of protection beyond what’s built into your device, especially if you’ve installed apps in the past that you’re unsure about. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

5) Keep your devices updated

Android security updates patch vulnerabilities that proxy operators may exploit. If you’re using an older phone, tablet or Android TV box that no longer receives updates, it may be time to upgrade. Unpatched devices are easier targets for hidden SDK abuse and botnet enrollment.

6) Use a strong password manager

If your device ever becomes part of a proxy network or is otherwise compromised, attackers often try to pivot into your accounts next. That’s why you should never reuse passwords. A password manager generates long, unique passwords for every account and stores them securely, so one breach does not unlock your email, banking or social media. Many password managers also include breach monitoring tools that alert you if your credentials appear in leaked databases, giving you a chance to act before real damage is done. Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.

7) Remove apps you don’t fully trust

Go through your installed apps and delete or uninstall anything you don’t recognize or haven’t used in months. The fewer apps running on your device, the fewer opportunities there are for hidden SDKs to operate. If you suspect your device has been compromised, consider a full reset and reinstall only essential apps from trusted sources.

ANDROID MALWARE HIDDEN IN FAKE ANTIVIRUS APP

Threat groups and state-linked actors allegedly used compromised devices to mask online activity and automate attacks. (Photo Illustration by Serene Lee/SOPA Images/LightRocket via Getty Images)

Kurt’s key takeaway

Residential proxy networks operate in a gray area that sounds harmless on paper but can quickly become a shield for cybercrime. In this case, millions of everyday devices were quietly enrolled into a system that attackers used to hide their tracks. Google’s takedown is a major move, but the broader market for residential proxies is still growing. That means you need to be cautious about what you install and what permissions you grant. Free apps are rarely truly free. Sometimes, the product being sold is you and your internet connection.

Have you ever installed an app that promised rewards for sharing bandwidth, or used a free VPN without thinking twice about it? Let us know your thoughts by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

Related Topics:Android cybercrime Featured Google Security

Click to comment

Technology

Did Live Nation punish a venue by taking Billie Eilish away?

Published

10 hours ago

March 4, 2026

Press Room

Did Live Nation punish a venue by taking Billie Eilish away?

John Abbamondi had orders to let the CEO of Ticketmaster down easy.

In April 2021, Abbamondi was the CEO of BSE Global, the company that ran Brooklyn arena the Barclays Center. BSE Global’s existing Ticketmaster contract would expire at the end of September, and Abbamondi and his team had evaluated proposals from SeatGeek, AXS, and Ticketmaster. The economics of Ticketmaster offer, according to Abbamondi, “was nowhere near as good as the other two.” SeatGeek’s technology was “superior” to Ticketmaster’s on balance, on top of better financial terms including an equity stake in the company, the arena decided. It clinched their decision to go with a newer, smaller player in the field.

When Abbamondi called to break the news to Michael Rapino, the Live Nation Entertainment CEO, the meeting became tense — and a recording of it came back to haunt Rapino in this month’s Live Nation-Ticketmaster monopoly trial. Abbamondi was one of two witnesses who took the stand Wednesday, alongside Mitch Helgerson, the chief revenue officer for the Minnesota Wild hockey team. Both men said that when they considered switching their venues’ ticketing platform from Ticketmaster, executives there threatened them with the loss of vital Live Nation-promoted concerts. It’s the behavior, the Justice Department and 40 state and district attorneys general say, of a monopolist — a charge Live Nation-Ticketmaster denies.

Abbamondi, identifying the voices on the 2021 call to a Manhattan jury Wednesday, said that “the nervous guy was me and the angry guy was Michael.” The few minutes played in court captures an exchange that went “sideways,” as Abbamondi put it, when he tried to thread a delicate needle: rejecting Ticketmaster’s services while trying to hold its parent company Live Nation to a separate contract promising to fill Barclays Center with concerts. At one point, Rapino dropped an F-bomb while discussing his frustration over a contractual dispute. He told Abbamondi he believed they were never planning to renew with Ticketmaster in the first place.

Rapino reminded Abbamondi about the new UBS Arena in Queens, which could draw more Live Nation-promoted shows away from Barclays. Though Ticketmaster theoretically operates separately from Live Nation, Abbamondi took this as a “not-so-veiled” threat — cut off the left arm, and the right arm would swing back. Abbamondi hung up feeling like he’d failed to “do my job there, which was to land the plane smoothly.”

The venue “saw a dramatic decline in Live Nation shows that were booked at the arena”

Abbamondi still signed the deal with SeatGeek, which began in October 2021. Then, he testified, the venue “saw a dramatic decline in Live Nation shows that were booked at the arena.” Artists were just beginning to fill stadiums again after the start of the covid pandemic, including Billie Eilish, who’d had to cancel shows in New York venues including Barclays in 2020. Normally, Abbamondi would have expected Live Nation to rebook her show there next time she was on tour. But when she began touring again in 2021, she booked at the new venue Rapino had warned about — the UBS Arena. When Barclays asked about it, they were told it was the “artist’s decision.” Other promoters, he said, hadn’t reduced their bookings at Barclays by nearly as much.

In 2022, mere months into the SeatGeek contract, Abbamondi was fired. Less than a year later, Barclays announced it was going back to Ticketmaster.

Ticketmaster, in the witnesses’ telling, wasn’t the best option for a ticketing vendor, but Live Nation’s power as a concert promoter forced their hand. In the case of the Minnesota Wild, which played at the then-Xcel Energy Center in St. Paul, Helgerson said the fear of losing Live Nation shows was a large driver behind its decision to stick with Ticketmaster — even though it found it would make $1 million a year more switching to SeatGeek.

The arena was already engaged in tight competition for concerts with the Target Center across the river in Minneapolis, a similarly-sized venue. So when the Wild kicked off negotiations over renewing its contract with Ticketmaster in 2018, the ticketing service knew how to hit them where it would hurt. When the Wild staff mentioned they were planning to consider a proposal from SeatGeek too, a Ticketmaster executive told them that Live Nation could move all of their shows to the Target Center if they switched ticketing vendors, Helgerson testified. “We took it as a credible threat,” he said. “Losing those shows would be almost catastrophic to our organization.”

“We took it as a credible threat”

To ease the risk, SeatGeek offered what it called “Live Nation retaliation insurance” — a promise to compensate the arena for concerts booked at the Target Center on dates Xcel had open. SeatGeek offered the arena a higher upfront bonus and fee share that overall would make the venue an additional $1 million a year compared to Ticketmaster’s offer. But even retaliation insurance couldn’t make up for the loss of the “vibrance of the venue” and the impact on its own employees should Live Nation pull its shows. Ticketmaster’s alleged threat created an “insurmountable challenge.” The venue signed another contract with Ticketmaster.

There were complicating factors in both these cases, which Live Nation pointed out on cross-examination. It was both risky and a lot of work to move to a new ticketing platform. Like switching any enterprise software, it would take a while for staff to get up to speed, and Abbamondi admitted that while SeatGeek’s technology gave them more options over things like how to price individual seats, it was less user-friendly. An executive whom Helgerson worked with worried that SeatGeek’s lack of an interface for concert promoters at the time would be an obstacle to getting them to bring shows to the arena. Abbamondi also said he’s personal friends with SeatGeek’s co-founder, and he testified he wasn’t fired because of the SeatGeek deal — he was given two other reasons.

SeatGeek offered what it called “Live Nation retaliation insurance”

There was also a separate legal dispute between the Barclays Center and Ticketmaster, which appeared to be at least part of the reason that the call between Abbamondi and Rapino broke down. Barclays believed their contract with Ticketmaster would expire at the end of September 2021, as originally stated. But Ticketmaster believed that because the Covid pandemic shortened the regular NBA season, a clause in the contract had been triggered to extend that contract another year. On top of that, in an earlier, unrecorded call between Abbamondi and Rapino, the Ticketmaster CEO suggested that they should be given the chance to counter any offer Barclays received. Abbamondi said he tried his best to respond in a “noncommittal” way, but the implication was that Rapino might have seen it differently.

The jury will have to decide whether the threats Abbamondi and Helgerson described were really as menacing as they believe, one of many factors that will determine whether Live Nation-Ticketmaster should face penalties — including the possibility of a breakup.

In one text exchange, Live Nation executive Patti Kim, a friend of Abbamondi’s, wrote that he should “think about the bigger relationship” with Live Nation, not just who’s writing the bigger check. She added a winky face. “That was my friend saying, ‘you know what I mean,’” Abbamondi said. This week, the jury is expected to get the chance to hear from the rival allegedly offering those bigger checks: SeatGeek CEO Jack Groetzinger.

Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.

Lauren Feiner

Technology

Scams that aren’t illegal (but should be)

Published

11 hours ago

March 4, 2026

Press Room

Scams that aren’t illegal (but should be)

NEWYou can now listen to Fox News articles!

Every year during National Consumer Protection Week, you hear warnings about phishing emails, fake IRS calls and identity theft. Those threats are real, but there is another risk that gets far less attention, and it is completely legal.

Right now, hundreds of companies collect, package and sell personal information, including your home address, phone number, family members, income estimates and even your daily habits. They are not targeting you because you did anything wrong. Instead, they profit simply because your data is valuable.

Unlike traditional scams, this does not happen in the shadows. It happens out in the open, every single day. As a result, most people only realize it is happening after someone uses their personal information against them.

Data brokers build detailed profiles using information pulled from public records, apps and online activity. (Kurt “CyberGuy” Knutsson)

Your personal information is a product

Data brokers are companies most people have never heard of, but they know a surprising amount about you. They collect information from public records, online activity, retail purchases, app usage and hundreds of other sources.

Then they build detailed profiles and sell them to advertisers, marketers and anyone else willing to pay. A typical profile may include:

Full names, ages and phone numbers
Home addresses
Names of relatives and household members
Estimated income, home value and net worth
Shopping habits and interests
Political, health and lifestyle indicators

This information often appears on people-search sites, where anyone can look you up in seconds. Scammers use these same databases to find and target victims. But even legitimate companies use them in ways most consumers never knowingly agreed to.

People-search sites expose more data than you realize

Search your own name online, and you may find pages listing your address, relatives’ names and contact details. These sites present themselves as “background check tools” or “public records directories.” But their business model depends on making personal information easy to find.

That creates real-world risks. Criminals use these sites to:
Impersonate banks, government agencies, or delivery services
Convince victims they already “know” them
Locate elderly or vulnerable individuals
Target family members using shared address history.

Even strangers can learn where you live, who your relatives are and how to contact you. No hacking required.

CRIMINALS ARE USING ZILLOW TO PLAN BREAK-INS. HERE’S HOW TO REMOVE YOUR HOME IN 10 MINUTES

People-search websites make your address, phone number and even family connections easy to find in seconds. (Serene Lee/SOPA Images/LightRocket via Getty Images)

Your browsing history is being tracked and sold

Many websites and apps track what you click, read and buy. Incogni’s research found that popular apps like TikTok, Alibaba, Temu and Shein collect numerous personally identifiable data points and share them with third parties, like advertising networks and data brokers.

Even web extensions track what you do online. Popular Chrome extensions like the AI-powered Grammarly or Quillbotinvade your privacy, require extensive permissions and collect sensitive data.

Over time, this data collection builds a behavioral profile. It can reveal:

Financial stress or debt concerns
Health interests or medical conditions
Major life events like moving, retirement, or the loss of a spouse
Online purchases and brand preferences.

This is why you may suddenly receive highly specific emails, calls, or ads that feel uncomfortably personal. Someone already knew what to say.

AI is accelerating data collection

AI makes personal data more valuable and easier to collect than ever before. These systems scrape public websites, social media profiles, images and videos to pull identifying details. They also connect scattered pieces of information into a single, detailed identity profile, which can include:

Photos connected to your name
Voice recordings from public videos
Employment history
Locations you’ve lived at or visited.

Once collected, this information can circulate indefinitely. You can delete a social media post, but copies of that data may already exist elsewhere.

5 SIMPLE TECH TIPS TO IMPROVE DIGITAL PRIVACY

The more accessible your personal data is, the easier it becomes for scammers to target you with convincing, personalized attacks. (Kurt “CyberGuy” Knutsson)

Most AI companies collect data by default, unless you opt out

Are you using ChatGPT, Gemini, or even LinkedIn? Then your data is automatically collected from your chatbot conversations, posts, and more. They collect user interactions like prompts, voice recordings, uploaded photos and behavioral data to improve the AI system.

In some cases, you have to manually disable this in settings, but it’s buried in countless opt-out guides or obscure labels. For example, to opt out of LinkedIn data collection, you need to:

Go to Settings and find the Privacy tab.
Find the toggle named ‘Data for Generative AI Improvement.’
Review other default data sharing options.
Disable everything from personal demographic information to social, economic and workplace research.

AI-powered apps and services continuously switch it up and make it harder for you to opt out. Why? Your data is fueling their business model. The more data points they have, the better they can train their AI and the more money they make.

Why this matters for your safety, not just your privacy

Most people think data collection is just about targeted ads. But the same information can be used to make scams far more convincing. Instead of sending generic phishing emails, scammers can reference your real address or recent activities.

For example: “Hi, Mr. Smith, this is your bank. We noticed unusual activity on your bank account, ending in 0123. Please confirm your information.”

Because the details are accurate, the message feels legitimate. This dramatically increases the chances someone will respond. In many cases, the information came from data broker databases that were legally purchased or accessed.

Consumer protection starts with reducing your digital footprint

National Consumer Protection Week is meant to empower people to protect themselves. That protection shouldn’t stop at obvious scams. It should include limiting how easily your personal information can be found in the first place.

A data removal service helps remove your personal data from data brokers and people-search sites that collect and sell it. Instead of submitting dozens or hundreds of manual requests yourself, they automate the process and continue removing your data as it reappears.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

Kurt’s key takeaways

When most people think about scams, they imagine criminals hiding in the shadows. But some of the biggest threats to your personal information are operating out in the open. Data brokers legally collect and sell detailed profiles about you. People-search sites make your address, phone number and even relatives easy to find in seconds. Your browsing activity is tracked, packaged and monetized. And now AI is speeding up how quickly that information can be gathered, connected and reused. This is not just about annoying ads. The more accessible your personal data is, the easier it becomes for scammers to sound convincing and target you with precision. Real consumer protection is not only about avoiding suspicious links. It is about limiting where your information lives and who can access it. The less strangers know about you, the harder it is to use your own data against you.

Have you ever searched for your name online and been surprised by what you found? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Technology

MacBook Neo versus an old MacBook Air: good luck

Published

22 hours ago

March 4, 2026

Press Room

MacBook Neo versus an old MacBook Air: good luck

My first thought when Apple announced the MacBook Neo today was “okay, but why not just get an older Air?” If you’re thinking that too, you might be right. If you can find one.

The Neo starts at $599 with an A18 Pro processor, 8GB of memory, and 256GB storage, and ends at $699 with the same specs plus TouchID and 512GB of storage. It has two USB-C (not Thunderbolt) ports, a pretty basic-looking screen, a mechanical trackpad instead of haptic, and various other cost-saving measures. It’s the cheapest new MacBook you can get now.

The new M5 MacBook Air starts at $1,099 with 16GB of memory and 512GB of much faster storage, a bigger and brighter screen, a better webcam, better Wi-Fi and Bluetooth, more speakers, Thunderbolt 4, a faster charger, and so forth. It’s $100 more than last year’s model, probably because of the Neo. Or you can get an M4 MacBook Air for $1000, with a slightly slower processor than the M5 (but still faster than the Air), and otherwise pretty much the same specs.

If you could still get a new M1 Air from Walmart for $700, it’d be a pretty tough call between that and the Neo. That machine came out in 2020, but is still better in most respects. Unfortunately, they’ve been out of stock since last month — probably because of the Neo — so that’s the end of that. You can probably find a refurb one. Same with the M3 and M4: if you can find one for around the same price as the Neo, especially with 16GB of RAM, you should get one of those. But they’re pretty thin on the ground, and I’d expect them to become thinner. (Keep an eye on Apple’s refurb site, though — a refurb M4 Air for $750 is pretty dang good.)

The modern Air is unquestionably a better computer. The thing about $1,000 is it’s a lot more money than $600. $600 is already more than most non-Mac people want to spend on a laptop, but it’s a lot less than an Air, and the gap between the two is big enough that it’s harder to justify the jump unless you know you’re gonna need more than 8GB of RAM, if you’re ever gonna use Thunderbolt, and so forth. I wouldn’t buy the Neo for myself.

The Neo isn’t meant to compete with the Air, though. It’s aiming for the first-time MacBook buyer. It’s Apple trying to pick up the cheap Windows laptop crowd who are annoyed by Windows. With its $499 price for education, it’s also an attempt to break the Chromebook’s stranglehold on the K-12 market, to turn iPad kids into MacBook Neo teens into Air adults. Heck, when it’s time for my kids to turn in their school-issued Chromebooks, and I have to choose between a Chromebook, a Windows laptop, and a MacBook Neo for them? That’ll be interesting.

And that’s how they get you!

I honestly don’t think the Neo vs Air debate is going to be that hard for most people, just because most people aren’t spending a thousand bucks on a laptop in the first place. The processor’s probably going to feel about the same as an M1 Air’s, which is to say fast enough for most things. The toughest parts are going to be figuring out if you’re satisfied with 8GB of RAM (rough!), if you ever really need Thunderbolt (maybe not?), and if you care about that fancy webcam (eh). If you already know the answer, you already know the answer. And you should probably grab that refurb Air while you can.

A cynical part of me thinks this is Apple trying to get MacBooks onto the same upgrade cycle as its phones. If you bought the cheapest MacBook Air six years ago, it’s probably still fine. If you buy the cheapest MacBook Neo today, is it going to feel fine in six years? Maybe! Or maybe you’ll decide you need to spring for an Air next time. And up the funnel you go.